Jamf Protect - Alerts

Back


Id	6098daa0-f05e-44d5-b5a0-913e63ba3179
Rulename	Jamf Protect - Alerts
Description	Creates an incident based on Jamf Protect Alert data in Microsoft Sentinel
Severity	High
Required data connectors	JamfProtect
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml
Version	1.0.6
Arm template	6098daa0-f05e-44d5-b5a0-913e63ba3179.json

KQL

jamfprotectalerts_CL
| extend
    algorithm = "SHA256",
    Host_IPs = tostring(parse_json(DvcIpAddr)[0]),
    Tags = parse_json(tostring(parse_json(tostring(input.match)).tags)),
    Tactics = case(input.match.tags has "Execution", "Execution", input.match.tags has "Visibility", "Visibility", input.match.tags has "Persistence", "Persistence", input.match.tags has "LateralMovement", "LateralMovement", input.match.tags has "CredentialAccess", "CredentialAcccess", input.match.tags has "DefenseEvasion", "DefenseEvasion", input.match.tags has "PrivilegeEscalation", "PrivilegeEscalation", input.match.tags has "Impact", "Impact", input.match.tags has "CommandAndControl", "CommandandControl", input.match.tags has "Discovery", "Discovery", input.match.tags has "InitialAccess", "InitialAccess", ""),
    Techniques = pack_array(extract(@"[A-Za-z]\d{4}", 0, tostring(input.match.tags))),
    JamfPro = case(input.match.actions has "SmartGroup", "Workflow with Jamf Pro", input.match.actions has "Prevented", "No workflow, Prevented by Protect", "No workflow")

YAML

name: Jamf Protect - Alerts
kind: NRT
status: Available
version: 1.0.6
tactics: 
alertDetailsOverride:
  alertDescriptionFormat: '{{EventResultMessage}} - Please investigate'
  alertTacticsColumnName: Tactics
  alertDynamicProperties:
  - alertProperty: ProviderName
    value: EventVendor
  - alertProperty: ProductName
    value: EventProduct
  - alertProperty: Techniques
    value: Techniques
  alertDisplayNameFormat: '{{EventMessage}} detected on {{DvcHostname}}'
  alertSeverityColumnName: EventSeverity
suppressionDuration: PT5H
suppressionEnabled: false
id: 6098daa0-f05e-44d5-b5a0-913e63ba3179
requiredDataConnectors:
- connectorId: JamfProtect
  dataTypes:
  - jamfprotectalerts_CL
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: 
description: |
    'Creates an incident based on Jamf Protect Alert data in Microsoft Sentinel'
customDetails:
  Protect_Tags: Tags
  TargetbinarySign: TargetbinarySignerType
  TargetBinarySignMsg: TargetBinarySigningInfoMessage
  Protect_Event_Type: EventType
  JamfPro_Status: JamfPro
  Related_File_hash: TargetBinarySHA256
  Protect_Analytic: EventMessage
  TargetBinarySigner: TargetBinarySigningTeamID
  Related_Binaries: TargetBinaryFilePath
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DvcHostname
    identifier: HostName
  - columnName: DvcOs
    identifier: OSFamily
  - columnName: DvcOsVersion
    identifier: OSVersion
- entityType: IP
  fieldMappings:
  - columnName: Host_IPs
    identifier: Address
- entityType: Process
  fieldMappings:
  - columnName: TargetProcessCurrentDirectory
    identifier: CommandLine
  - columnName: TargetProcessId
    identifier: ProcessId
- entityType: FileHash
  fieldMappings:
  - columnName: algorithm
    identifier: Algorithm
  - columnName: TargetBinarySHA256
    identifier: Value
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: false
    lookbackDuration: PT5H
    reopenClosedIncident: false
severity: High
query: |
  jamfprotectalerts_CL
  | extend
      algorithm = "SHA256",
      Host_IPs = tostring(parse_json(DvcIpAddr)[0]),
      Tags = parse_json(tostring(parse_json(tostring(input.match)).tags)),
      Tactics = case(input.match.tags has "Execution", "Execution", input.match.tags has "Visibility", "Visibility", input.match.tags has "Persistence", "Persistence", input.match.tags has "LateralMovement", "LateralMovement", input.match.tags has "CredentialAccess", "CredentialAcccess", input.match.tags has "DefenseEvasion", "DefenseEvasion", input.match.tags has "PrivilegeEscalation", "PrivilegeEscalation", input.match.tags has "Impact", "Impact", input.match.tags has "CommandAndControl", "CommandandControl", input.match.tags has "Discovery", "Discovery", input.match.tags has "InitialAccess", "InitialAccess", ""),
      Techniques = pack_array(extract(@"[A-Za-z]\d{4}", 0, tostring(input.match.tags))),
      JamfPro = case(input.match.actions has "SmartGroup", "Workflow with Jamf Pro", input.match.actions has "Prevented", "No workflow, Prevented by Protect", "No workflow")

ARM